228 lines
9.5 KiB
Diff
228 lines
9.5 KiB
Diff
From 945a85d4d7867d103d1a98093cc5122fadd55845 Mon Sep 17 00:00:00 2001
|
||
From: liuxinhao <liuxinhao@kylinsec.com.cn>
|
||
Date: Wed, 31 May 2023 14:19:54 +0800
|
||
Subject: [PATCH 4/5] fix(multi factor): Fixed an authentication failure caused
|
||
by disabling all authentication modes during multi-factor authentication
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
- 修复多因子认证时，关闭所有非密码认证，认证失败的问题，认证服务进行密码认证时放行，密码认证流程由PAM模块以及PAM配置管理
|
||
|
||
Closes #I79I33
|
||
---
|
||
data/kiran-authentication-service | 7 +++--
|
||
src/daemon/auth-manager.cpp | 1 +
|
||
src/daemon/session.cpp | 29 +++++++++++++------
|
||
src/daemon/session.h | 1 +
|
||
src/pam/authentication-graphical.cpp | 1 -
|
||
src/pam/authentication-terminal.cpp | 1 -
|
||
src/pam/authentication.cpp | 6 ----
|
||
.../kiran-authentication-daemon.zh_CN.ts | 11 +++++--
|
||
8 files changed, 35 insertions(+), 22 deletions(-)
|
||
|
||
diff --git a/data/kiran-authentication-service b/data/kiran-authentication-service
|
||
index afc7e17..e0f2763 100644
|
||
--- a/data/kiran-authentication-service
|
||
+++ b/data/kiran-authentication-service
|
||
@@ -1,5 +1,8 @@
|
||
-# NOTE:需要将/etc/pam.d/system-auth中pam_faillock中控制流程字段由required修改为requisite
|
||
+# NOTE:
|
||
+# 需要将/etc/pam.d/system-auth中pam_faillock中控制流程字段由required修改为requisite
|
||
# 若不修改，用户已锁定也能开始认证，无论认证是否成功都会失败，并且无提示。
|
||
+# sudo 若用户已锁定，仍然会尝试多次
|
||
+# sudo visudo ,添加'Defaults passwd_tries=1'行，将sudo尝试次数修改为1
|
||
|
||
# =========================认证配置项目================================ #
|
||
# 多路认证模式，成/功则认证通过，失败/切换到密码 跳过多因子认证模式
|
||
@@ -10,7 +13,7 @@ auth [success=done ignore=2 default=die] pam_kiran_authentication.so doauth
|
||
|
||
# 认证服务后续认证流程兼容，走系统错误计数failock, pam_debug只是修改认证状态值为成功
|
||
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
||
-auth required pam_debug
|
||
+auth required pam_debug.so
|
||
|
||
# 认证成功，清理内部记录错误次数
|
||
account required pam_kiran_authentication.so authsucc
|
||
\ No newline at end of file
|
||
diff --git a/src/daemon/auth-manager.cpp b/src/daemon/auth-manager.cpp
|
||
index 7ebef89..3d7aaf0 100644
|
||
--- a/src/daemon/auth-manager.cpp
|
||
+++ b/src/daemon/auth-manager.cpp
|
||
@@ -196,6 +196,7 @@ QList<int> AuthManager::GetAuthTypeByApp(int32_t authApp)
|
||
enabledAuthTypeIter++;
|
||
}
|
||
|
||
+ sortedAuthTypes << KAD_AUTH_TYPE_PASSWORD;
|
||
KLOG_DEBUG() << "get auth types by app:" << authApp << "result:" << sortedAuthTypes;
|
||
return sortedAuthTypes;
|
||
}
|
||
diff --git a/src/daemon/session.cpp b/src/daemon/session.cpp
|
||
index f24a697..e8c516b 100644
|
||
--- a/src/daemon/session.cpp
|
||
+++ b/src/daemon/session.cpp
|
||
@@ -128,17 +128,11 @@ void Session::StartAuth()
|
||
DBUS_ERROR_REPLY_AND_RET(QDBusError::AccessDenied, KADErrorCode::ERROR_USER_IDENTIFIYING);
|
||
}
|
||
|
||
- if (this->m_authType == KAD_AUTH_TYPE_NONE || this->m_authType == KAD_AUTH_TYPE_PASSWORD)
|
||
- {
|
||
- KLOG_WARNING() << m_sessionID << "auth type is invalid" << this->m_authType << ",start auth failed";
|
||
- DBUS_ERROR_REPLY_AND_RET(QDBusError::Failed, KADErrorCode::ERROR_FAILED);
|
||
- }
|
||
-
|
||
KLOG_DEBUG() << m_sessionID << "start auth";
|
||
this->m_verifyInfo.m_inAuth = true;
|
||
this->m_verifyInfo.m_dbusMessage = this->message();
|
||
this->startPhaseAuth();
|
||
-}
|
||
+}
|
||
|
||
void Session::StopAuth()
|
||
{
|
||
@@ -258,11 +252,15 @@ void Session::startPhaseAuth()
|
||
|
||
// 开始阶段认证前,通知认证类型状态变更
|
||
emit this->m_dbusAdaptor->AuthTypeChanged(this->m_authType);
|
||
+
|
||
switch (this->m_authType)
|
||
{
|
||
case KAD_AUTH_TYPE_UKEY:
|
||
startUkeyAuth();
|
||
break;
|
||
+ case KAD_AUTH_TYPE_PASSWORD:
|
||
+ startPasswdAuth();
|
||
+ break;
|
||
default:
|
||
startGeneralAuth();
|
||
break;
|
||
@@ -282,6 +280,14 @@ void Session::startUkeyAuth()
|
||
Q_EMIT this->AuthPrompt(tr("please input ukey code."), KADPromptType::KAD_PROMPT_TYPE_SECRET);
|
||
}
|
||
|
||
+void Session::startPasswdAuth()
|
||
+{
|
||
+ KLOG_DEBUG() << "The authentication service does not take over password authentication,ignore!";
|
||
+ this->m_verifyInfo.m_inAuth = true;
|
||
+ this->m_verifyInfo.m_authenticatedUserName = m_userName;
|
||
+ this->finishPhaseAuth(true,false);
|
||
+}
|
||
+
|
||
void Session::startGeneralAuth(const QString &extraInfo)
|
||
{
|
||
auto deviceType = Utils::authType2DeviceType(this->m_authType);
|
||
@@ -299,7 +305,8 @@ void Session::startGeneralAuth(const QString &extraInfo)
|
||
{
|
||
auto authTypeStr = Utils::authTypeEnum2Str(this->m_authType);
|
||
KLOG_WARNING() << m_sessionID << "start phase auth failed,can not find device,auth type:" << m_authType;
|
||
- Q_EMIT this->AuthMessage(tr(QString("can not find %1 device").arg(authTypeStr).toStdString().c_str()), KADMessageType::KAD_MESSAGE_TYPE_ERROR);
|
||
+ Q_EMIT this->AuthMessage(QString(tr("can not find %1 device")).arg(Utils::authTypeEnum2LocaleStr(this->m_authType)),KADMessageType::KAD_MESSAGE_TYPE_ERROR);
|
||
+
|
||
this->finishPhaseAuth(false, false);
|
||
return;
|
||
}
|
||
@@ -352,7 +359,11 @@ void Session::finishPhaseAuth(bool isSuccess, bool recordFailure)
|
||
break;
|
||
case KADAuthMode::KAD_AUTH_MODE_AND:
|
||
{
|
||
- this->m_authOrderWaiting.removeOne(this->m_authType);
|
||
+ if( this->m_authOrderWaiting.size() > 0 )
|
||
+ {
|
||
+ this->m_authOrderWaiting.removeOne(this->m_authType);
|
||
+ }
|
||
+
|
||
if (this->m_authOrderWaiting.size() == 0)
|
||
{
|
||
this->finishAuth(isSuccess, recordFailure);
|
||
diff --git a/src/daemon/session.h b/src/daemon/session.h
|
||
index 2998f73..a850237 100644
|
||
--- a/src/daemon/session.h
|
||
+++ b/src/daemon/session.h
|
||
@@ -98,6 +98,7 @@ private:
|
||
private:
|
||
void startPhaseAuth();
|
||
void startUkeyAuth();
|
||
+ void startPasswdAuth();
|
||
void startGeneralAuth(const QString &extraInfo = QString());
|
||
|
||
void finishPhaseAuth(bool isSuccess,bool recordFailure = true);
|
||
diff --git a/src/pam/authentication-graphical.cpp b/src/pam/authentication-graphical.cpp
|
||
index 619f3cf..2f104ac 100644
|
||
--- a/src/pam/authentication-graphical.cpp
|
||
+++ b/src/pam/authentication-graphical.cpp
|
||
@@ -64,7 +64,6 @@ void AuthenticationGraphical::notifySupportAuthType()
|
||
{
|
||
auto authType = this->m_authManagerProxy->GetAuthTypeByApp(m_authApplication);
|
||
QList<int> authTypeList = authType.value();
|
||
- authTypeList << KAD_AUTH_TYPE_PASSWORD;
|
||
|
||
QStringList authTypeStrList;
|
||
for (auto authType : authTypeList)
|
||
diff --git a/src/pam/authentication-terminal.cpp b/src/pam/authentication-terminal.cpp
|
||
index 5db6b1c..01d66c6 100644
|
||
--- a/src/pam/authentication-terminal.cpp
|
||
+++ b/src/pam/authentication-terminal.cpp
|
||
@@ -34,7 +34,6 @@ void AuthenticationTerminal::notifySupportAuthType()
|
||
{
|
||
auto authType = this->m_authManagerProxy->GetAuthTypeByApp(m_authApplication);
|
||
QList<int> authTypeList = authType.value();
|
||
- authTypeList << KAD_AUTH_TYPE_PASSWORD;
|
||
|
||
QList<KADAuthType> tempAuthTypeList;
|
||
for (auto authType : authTypeList)
|
||
diff --git a/src/pam/authentication.cpp b/src/pam/authentication.cpp
|
||
index 6a165fd..06bc010 100644
|
||
--- a/src/pam/authentication.cpp
|
||
+++ b/src/pam/authentication.cpp
|
||
@@ -184,14 +184,8 @@ int Authentication::startAuthPre()
|
||
{
|
||
auto authTypeReply = m_authManagerProxy->GetAuthTypeByApp(m_authApplication);
|
||
QList<int> authTypeList = authTypeReply.value();
|
||
- if (m_authApplication == KAD_AUTH_APPLICATION_NONE || authTypeList.isEmpty())
|
||
- {
|
||
- this->m_pamHandle->syslog(LOG_DEBUG, QString("The pam service '%1' is unsupported or authentication type is not configured.").arg(this->m_serviceName));
|
||
- return PAM_IGNORE;
|
||
- }
|
||
|
||
this->notifyAuthMode();
|
||
-
|
||
RETURN_VAL_IF_TRUE(!this->initSession(), PAM_SYSTEM_ERR);
|
||
|
||
if (this->m_authManagerProxy->authMode() == KADAuthMode::KAD_AUTH_MODE_OR)
|
||
diff --git a/translations/kiran-authentication-daemon.zh_CN.ts b/translations/kiran-authentication-daemon.zh_CN.ts
|
||
index 4292ee7..8c03e2c 100644
|
||
--- a/translations/kiran-authentication-daemon.zh_CN.ts
|
||
+++ b/translations/kiran-authentication-daemon.zh_CN.ts
|
||
@@ -12,20 +12,25 @@
|
||
<context>
|
||
<name>Kiran::Session</name>
|
||
<message>
|
||
- <location filename="../src/daemon/session.cpp" line="201"/>
|
||
+ <location filename="../src/daemon/session.cpp" line="195"/>
|
||
<source>Please wait while the %1 request is processed</source>
|
||
<translation>%1认证请求正在等待处理</translation>
|
||
</message>
|
||
<message>
|
||
- <location filename="../src/daemon/session.cpp" line="281"/>
|
||
+ <location filename="../src/daemon/session.cpp" line="279"/>
|
||
<source>Insert the UKey and enter the PIN code</source>
|
||
<translation>请插入UKey并输入PIN码</translation>
|
||
</message>
|
||
<message>
|
||
- <location filename="../src/daemon/session.cpp" line="282"/>
|
||
+ <location filename="../src/daemon/session.cpp" line="280"/>
|
||
<source>please input ukey code.</source>
|
||
<translation>请输入PIN码。</translation>
|
||
</message>
|
||
+ <message>
|
||
+ <location filename="../src/daemon/session.cpp" line="308"/>
|
||
+ <source>can not find %1 device</source>
|
||
+ <translation>未能检测到%1设备</translation>
|
||
+ </message>
|
||
</context>
|
||
<context>
|
||
<name>Kiran::User</name>
|
||
--
|
||
2.33.0
|
||
|